Description
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 2:2.2.8-1 | — |
| Debian 13 | python-django | 2:2.2.8-1 | — |
| Debian 12 | python-django | 2:2.2.8-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 2.1, < 2.1.15 | 2.1.15 | GHSA-hvmf-r92r-27hr |
| PyPI | django | >= 2.2, < 2.2.8 | 2.2.8 | GHSA-hvmf-r92r-27hr |
| PyPI | django | >= 2.1, < 2.1.15 · >= 2.2, < 2.2.8 | 2.1.15, 2.2.8 | PYSEC-2019-15 |
Advisories 7
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://docs.djangoproject.com/en/dev/releases/security/
- [oss-security] 20191202 Django 2.2.8 and 2.1.15: CVE-2019-19118: Privilege escalation in the Django admin. mailing-list
- https://groups.google.com/forum/#%21topic/django-announce/GjGqDvtNmWQ
- https://www.djangoproject.com/weblog/2019/dec/02/security-releases/
- https://security.netapp.com/advisory/ntap-20191217-0003/
- FEDORA-2019-adc8990386 vendor-advisory
- GLSA-202004-17 vendor-advisory